DRAFT_Medical Support Services SOW_18 May 2022.pdf

DRAFT

STATEMENT OF WORK

FOR

TSA MEDICAL SERVICES

1.0 GENERAL

1.1 BACKGROUND

The Transportation Security Administration (TSA) was established with the enactment of the Aviation and Transportation Security Act (ATSA) of 2001 Public Law 107-71. The mission of the TSA is to protect the nation’s transportation systems, while ensuring the free movement of people and goods.

As established by ATSA, TSA is an excepted service Federal Agency. ATSA gives TSA the flexibility required to complete its security based mission. In accordance with 49 U.S.C.

(§114(n) and §40122(g)) ATSA provides that the personnel management system of the Federal Aviation Administration shall apply to TSA, as modified by the TSA Administrator.

Transportation Security Administration (TSA) Human Capital (HC) must recruit, hire and maintain a diverse, well-qualified workforce in compliance with the Aviation and Transportation Security Act (ATSA), Public Law 107-71 (November 19, 2001), as well as other federal human resources requirements. Although TSA is not governed by Title 5 of the United States (U.S.)

Code (USC), the Agency has entered into an Interchange Agreement with the U.S. Office of Personnel Management (OPM), which requires TSA to apply competitive principles for reciprocity that allows TSA employees to qualify for positions within Title 5 agencies.

ATSA has established the authority of the TSA’s Administrator to determine physical and psychological requirements for the security screening workforce. TSA developed medical guidelines for clinical evaluations and fitness for duty determinations to “ensure that Federal screeners are able to provide the best security possible.” The evolution of security operations from process-driven procedural-based security to risk-based intelligence driven security affirms the need for a resilient screening workforce that can readily adapt to changing threats and mission, whose readiness and fitness is measurable, demonstrable, and enforceable.

On October 9, 2013, TSA leadership approved the establishment of the Office of Chief Medical Officer (OCMO) to assume responsibility for Transportation Security Officers (TSO) medical reviews, determination decisions, and institutionalizing of medical standards and fitness for duty assessments of the screening workforce. Within HC, the Office of Chief Medical Officer (OCMO) helps ensure the TSA workforce is mission ready. The office is staffed by occupational health professionals responsible for managing health policy, maintaining medical records, and serving as TSA’s physician authority for medical determinations.

In 2014, the TSA’s Administrator charged OCMO with the planning, piloting, and execution of a periodic Annual Medical re-certification (AMC) program. The purpose of the AMC is to ensure that covered employees continue to meet the current minimum medical requirements of their position. A covered employee is an employee occupying a position with medical requirements identified and explained in approved, position specific, medical guidelines. In 2018, TSA has completed the functional requirements for an Annual Medical Certification (AMC) program using an electronic medical questionnaire for covered employees to medically self-certify.

1.2 SCOPE

The purpose of this requirement is to obtain and maintain a Nationwide Network of Medical Services (NNMS) affiliates within twenty-five (25) miles of each airport and Federal Air Marshall Service (FAMS) Field Office, for TSA candidates and employees to locally attend medical exams and drug testing.

The NNMS affiliates shall be responsible for conducting specified medical examinations, such as physical examinations, color vision testing, distance vision testing, hearing testing, and drug specimen collection in accordance with the current TSA Medical and Psychological Guidelines applicable for the position exam types being conducted.

For candidate exams, the vendor will be responsible for making medical eligibility and drug testing eligibility determinations for employment; by adjudicating the candidate against the applicable Medical and Psychological Guidelines.

For candidates, the vendor will be responsible for managing an appeal process for the candidates to provide additional supporting documentation to determine if there should be a change in the eligibility determination.

For employee exams, the vendor will be responsible for providing appropriate medical review of covered employees’ self- certifying electronic medical questionnaires, and, when needed, contact and question employees to obtain necessary information or to initiate the next steps of assessment in order to clear the employee. The contractor will perform the medical exam and testing relevant to the position, review all medical materials for completeness, and make a medical eligibility determination.

These positions requiring medical exams may include, but are not limited to Transportation Security Officers (TSO), Federal Air Marshal (FAM), Transportation Security Specialists – Explosive Detection Canine Handlers (TSS-EDCH), Transportation Security Specialists – Explosives (TSS-E), and Criminal Investigators (CI).

Provide a secure candidate medical tracking capability that is used during the medical adjudication process to track candidate progress and facilitate evaluation against TSA’s medical guidelines. Medical records shall be handled/stored/tracked in accordance with current privacy laws and TSA systems and records security requirements and provide Medical Screening Administrative Support. The medical records shall be provided in a secure manner to the Office of the Chief Medical Officer within 1 week upon request.

1.3 OBJECTIVE

The purpose of this requirement is for TSA to obtain a qualified contractor that shall provide a network of Medical Services nationwide, inclusive of medical test and exams functioning to assist TSA in the recruitment of qualified candidates and the timely and successful return of its employees to the workforce.

1.4 APPLICABLE REQUIREMENT

1.4.1 FEDERAL REQUIREMENTS

FEDERAL LAW: ATSA PL 107-71, Aviation and Transportation Security Act, 49 USC 40101 http://fwww.tsa.gov/assets/pdf/Aviation and Transportation Security Act ATSA public law 107 1771.pdf

Privacy Act of 1974 (5 USC 552a) Public Information http://www.opm.gov/feddata/USC552a.txt

1.4.2 APPLICABLE DOCUMENTS

5 United States Code (USC) §§ 8101 - 8193 20 Code of Federal Regulations (CFR) Part 10 DHS 4300A, Sensitive Systems Handbook TSA MD 11056.1, Sensitive Security Information (SSI) All applicable DHS and TSA Management Directives, as deemed necessary NIST SP 800-53, Rev 3, Recommended Security Controls for Federal

Information Systems Federal Information Security Management Act (FISMA) of 2002, Public Law

107-347

1.4.3 TSA is required to follow all applicable regulations and statues under the Federal Employees’ Compensation Act.

1.4.4 TSA is required to comply with Department of Homeland Security FISMA and

TSA’s security Certification and Accreditation (C&A) requirements and federal privacy regulations, including the submission of all required security documentation.

2.0 SPECIFIC REQUIREMENTS / TASKS:

The following is a summary of the performance requirements for execution of TSA Medical Services:

2.1 TASK ONE: MEDICAL EVALUATION – CONDUCTING MEDICAL

EVALUATIONS

The Medical Evaluation component is intended to assess TSA employee and candidate physical and medical abilities to meet the requirements of their position. TSA needs the ability to have direct communication with the medical provider and to be able to directly engage and receive information from the doctors/physicians conducting the medical examinations. In support of the Medical Evaluations, the Contractor shall:

2.1.1 Establish and maintain a nationwide network of medical affiliates, within 25 miles of each airport and FAMS Field Office, to support both TSA employees and TSA candidates with local medical exams and drug testing.

2.1.2 Medical affiliates shall be responsible for conducting specified medical examinations, such as physical examinations, vision testing, hearing testing, and drug specimen collection in accordance with the current TSA Medical and Psychological Guidelines for the position exam types being conducted.

2.1.3 Provide a medical scheduling capability that allows employees/candidates to be able to schedule medical exams in an efficient and timely manner.

2.1.4 Conduct outreach to employees/candidates to schedule their medical exams within the required timeframe.

a) Provide a toll free number for employees/candidate to contact if they need assistance scheduling, re-scheduling, or canceling their exam, have questions about medical documentation, or the appeal process.

b) Provide an e-mail address for employees/candidate to contact if they have questions or need to submit supporting medical documentation.

2.1.5 Provide a secure candidate medical tracking capability that is used during the medical adjudication process to track candidate progress and facilitate evaluation against TSA’s Medical and Psychological Guidelines.

Note: Medical records shall be handled/stored in accordance with current privacy laws and TSA systems and records security requirements.

2.1.6 Establish and deploy mobile medical and drug testing evaluation capability upon request by TSA for any locale without a static medical affiliate or in support of a hiring event.

a) The Contractor shall respond to TSA with a firm date for scheduling a mobile medical session within three days of notification from TSA.

b) The mobile medical unit shall be set up and deployed within two weeks or less upon receiving TSA OHC approval.

2.1.7 Ensure the medical affiliates have sufficient appointment capacity commensurate with individual airport candidate/employee volumes.

(Sufficient capacity is defined as being able to offer a candidate as many as three (3) possible appointment dates that would be on average within seven (7) calendar days of when the candidate/employee needs to schedule an appointment).

2.1.8 Integrate any new medical evaluation procedures or components based on changes in position duties and responsibilities, or changes in the assessment process/criteria.

2.1.9 Provide all applicable instructions and requirements to the contractor’s medical affiliates and all third party medical providers who will administer medical/drug evaluations.

2.1.10 Administer all medical/drug evaluations consistent with TSA protocol.

a. Drug Testing should follow the Department of Health and Human Services (HHS) and the Department of Transportation (DOT) guidelines for drug and alcohol testing. Note: In accordance with current HHS and DOT guidelines, the Contractor shall establish an internal drug testing program to ensure that Contractor employees involved in the processing and reporting of drug test collections are drug free.

2.1.11 Conduct on-site Quality Assurance Reviews (QAR) of contractor conducted medical/drug testing sites; and provide quarterly reports to TSA on accuracy, discrepancies, and corrective actions.

2.1.12 Report and mitigate any medical/drug incidents that occur.

a) Report any information regarding inappropriate practices engaged by contractor personnel immediately to TSA.

b) Maintain incident reports for any medical administration anomalies.

c) Receive, document, and evaluate applicant medical evaluation appointment complaints/concerns/incidents.

d) Monitor, maintain, and review incidents reported. Provide reports on trends or areas of concern to TSA HC; and determine appropriate actions based on established TSA HC business rules.

2.1.13 Evaluate the medical qualification of each applicable TSA employee/candidate against the latest applicable medical guidelines. TSA will provide the medical guidelines and protocols to be followed.

Responsibilities for conducting the evaluation by the contractor for each candidate shall include:

a) Manage and conduct all aspects of the medical evaluation and any follow-up evaluation required of employees/candidates.

b) Provide medical equipment, facilities, and qualified personnel to administer the medical history collection and medical evaluation, and to make a determination of each employee/ candidate medical qualification.

c) Ensure that the results of these medical evaluations are incorporated into the Contractor’s medical tracking capability and maintained in “real time” to ensure timely follow-up and availability of medically qualified candidates for further consideration.

d) Provide medical review officer verification for all medical tests/evaluations conducted for both TSA employees/candidates.

e) Complete the medical disposition process resulting from medical evaluations, and collect and store all medical data produced.

f) Provide feedback to the TSA HC Office of Chief Medical Officer (OCMO) regarding application of the medical guidelines, as needed.

Medical guidelines will be provided after contract award.

2.1.14 Determine the employee/candidate’s pass/fail status of each medical/drug evaluation, notify candidates accordingly, and advise candidates of the specific reason(s) for medical review failure; to include instructions on how to appeal their medical determination or resolve any potential questions or errors.

2.1.15 Notify candidates via e-mail and trackable letter via priority mail of their medical and drug results and applicable next steps.

2.1.16 Ensure that all medical materials (e.g., guidelines, questionnaires, evaluation forms, etc.) are kept secure at all times and that no information is obtained or made available to applicants or others inappropriately.

2.1.17 Support TSA candidates in the medical evaluation process including those going through the competitive hiring process as well as any non-competitive reinstatement process.

2.2 TASK TWO: Medical Evaluation – Administrative Support.

In support of the Medical Evaluation – Administrative Support for the TSO Hiring process, the Contractor shall:

2.2.1 Provide an efficient means for each TSA employee/candidate to schedule his or her medical/drug evaluation.

2.2.2 Assist TSA employees/candidates to schedule their medical/drug evaluations.

2.2.3 Initiate reminder emails and outbound calls to encourage/assist employees and candidates with scheduling their medical/drug evaluations.

a) Manage medical/drug exam no-shows, re-schedule requests, and cancelations per TSA HC business rules.

b) Receive phone calls from candidates concerning cancellations or rescheduling of medical appointments.

c) Monitor and detect candidates who failed to appear on their scheduled medical date; and extend outreach to reschedule.

d) Apply the appropriate TSO business rules regarding medical scheduling.

2.2.4 Communicate to TSA (or its designated R&H system Operations and Maintenance vendor) through manual process each TSA employee’s/candidate’s appointment scheduling progress status (e.g., pending scheduling, scheduled, attended, etc.).

2.2.5 Communicate to TSA (or its designated R&H system O&M vendor) through manual process each TSA employee’s/candidate’s medical/drug evaluation status and results (e.g., In-review, Pass, Fail, etc.).

2.2.6 Provide TSA support with TSA candidate Equal Employment Opportunity (EEO) cases and litigation. Support includes: providing copies of prior candidate’s medical records, providing copies of prior candidate’s correspondences and history of interactions, providing verbal and/or written summary case reviews with designated Government Responding Officials in preparation for participation in EEO Alternate Dispute Resolution (ADR) facilitation process with TSA candidates, participating as a subject matter expert during any applicable ADR facilitation process meetings with TSA candidates, assisting with drafting responses to affidavit questions for TSA HC employee, assisting with drafting responses to affidavit questions by vendor staff, and providing medical deposition during hearings.

2.2.7 Inventory and box all “inactive” candidate medical records in compliance with all TSA Records Management Program requirements for shipment to a National Archives and Records Administration (NARA) or designated storage facility. This includes making arrangements for transportation to the designated federal storage facility, to include but not limited to, obtaining the sub-contract transport service, providing driver background information to TSA Personnel Security, and providing warehouse labor in support of the packing, auditing, loading, and shipping operation process.

Note: This paper records storage process may migrate to an electronic storage process at a future date to be determined.

2.2.8 Maintain the master copies of any medical questionnaires used in the candidate/employee evaluation process; assist with making updates to those questionnaires upon TSA request; and handle electronic transmittal/dissemination of these questionnaires in an efficient manner.

2.3 TASK THREE: Pre-Employment Medical Evaluation – FAMS specific.

TSA needs the ability to have direct communication with the medical provider and to be able to directly engage and receive information from the doctors/physicians conducting the medical examinations.

Currently, Federal Air Marshal (FAM) candidates have a choice of attending their pre-employment medical exam at a Federal Air Marshal Service (FAMS) Medical Branch Facility (e.g., Atlantic City, NJ) or attend at a local medical affiliate within the vendors NNMS. The majority of candidates will opt to attend at the NNMS. FAM candidates are given this option on medical scheduling as if they opt to attend at the FAMS Medical Branch facility they can also complete their polygraph during the same visit to the FAMS facility.

In support of the Pre-Employment Medical Evaluation for FAM Hiring, the Contractor shall:

2.3.1 Receive notification that a candidate can proceed with medical scheduling (e.g., a FAM candidate typically becomes eligible to attend a medical evaluation after successfully completing an initial preliminary review of their background documentation by TSA Personnel Security (PerSec);

making them eligible for medical scheduling).

2.3.2 Contact eligible candidates to advise them of their medical scheduling options (e.g., attend at a FAMS Medical Branch facility or at a local vendor NNMS health clinic); track and monitor candidate responses.

a) As needed, make medical scheduling reminder outbound calls to non-responsive candidates

b) Applying at least three contact attempts (combination of phone calls and emails spread out over several days) to involuntarily withdraw nonresponsive candidates in accordance with HC Business Rules.

2.3.3 Record/track candidates scheduling option and communicate that to TSA (or its designated R&H system O&M vendor) through manual process.

2.3.4 For FAM candidates attending at vendor NNMS sites, the vendor will conduct the medical exams and gather candidate information as described in this SOW. However, the information from those exams will be provided to the FAMS Medical Branch to conduct the employment eligibility adjudication vice the vendor making these determinations. This adjudication process is unique to only FAM candidates.

a) Forward all FAM candidate documentation and reports received from clinics to the FAM Medical Branch for evaluation and retention in the candidate’s permanent medical file.

2.3.5 Receive from the FAM Medical Branch the results of initial medical evaluations, requests for additional information, or the results of re-evaluations by the FAM Medical Branch to determine candidate suitability.

2.3.6 Advise TSA (PerSec) when FAM candidates are found medically eligible.

Note: This will advise TSA PerSec to complete the full pre-hire background adjudication on eligible candidates.

2.4 TASK FOUR: REPORTS

2.4.1 Medical Affiliate Distance Report – Provides a listing of all medical affiliate locations, as well as their distances to the nearest federalized airport/FAMS Field Office. Report shall be updated as changes occur.

2.4.2 TSO Medical Capacity Report – Provides weekly and consolidated monthly medical examination capacity per affiliate/location. This report is used to identify any capacity issues and need to augment capacity in high priority locations:

a) TSO Mobile Medical Report - This report provides a listing of past and future scheduled mobile medical deployments by airport and by date, the number of exams available, the number of exams scheduled, the number of no-shows, and pass/fail/hold counts.

b) Average Processing Time Report – Provides the average processing time (in days) from when a candidate becomes eligible to schedule a medical exam until scheduled; scheduled until attended; attended until adjudicated; and total medical processing time. The report should be produced on a monthly basis, by position type, and be able to be run across an alternate defined timeframe if needed (e.g., Calendar Year to date).

2.4.2.b.1 For TSO candidates, this data should be sortable by airport duty location

2.4.2.b.2 For FAM candidates, this data should be sortable by FAMS Field Office (with the last process stage capturing attended until information submitted to TSA)

2.5 TASK FIVE: APPLICANT MEDICAL EXAMINATIONS & TESTING

2.5.1 PERFORM MEDICAL EVALUATIONS - EXAMINATIONS AND

TESTING

The medical evaluation will consist of the following: Review of the Health History Questionnaire; A physical examination performed by a licensed independent practitioner:

Doctor of Medicine (M.D.)/Doctor of Osteopathic Medicine (D.O.) or Nurse Practitioner (NP) or Physician Assistant (PA). Diagnostic testing will be determined by TSA/OCMO depending on the position applied for. Where available, pulse oximetry will be included with the vital signs.

The contractor shall provide Medical Examinations and Testing to applicants to the following TSA positions:

2.5.2 For Transportation Security Officers (TSOs), provide the following

a. History and physical exam

b. Urinalysis

c. Audiometry

d. Comprehensive vision, to include

1) distance visual acuity

2) near visual acuity

3) intermediate visual acuity

4) Hardy-Rand-Rittler (HRR) 4th edition color vision test

e. Vital signs

2.5.3 For Transportation Security Specialists (TSS) – Explosive Detection Canine Handlers (EDCH), to provide the following:

a. History and physical exam

b. Urinalysis

c. Audiometry

d. Electrocardiogram

e. Comprehensive vision

f. Vital signs

2.5.4 For Transportation Security Specialists – explosives (TSS-E), the contractor will perform the following:

a. History and physical exam

b. Urinalysis

c. Audiometry

d. Comprehensive vision, to include:

1) distance visual acuity

2) near visual acuity

3) intermediate visual acuity

4) Hardy-Rand-Rittler (HRR) 4th edition color vision test

e. Vital signs

2.5.5 For Criminal Investigators, the contractor will perform the following:

a. History and physical exam

b. Urinalysis

c. Audiometry

d. Electrocardiogram

e. Comprehensive vision

f. Vital signs

g. Complete metabolic panel (fasting)

h. Lipid panel (fasting)

i. Complete blood count with differential

2.5.6 For Federal Air Marshal, the contractor will perform the following:

a. History and physical exam

b. Urinalysis

c. Audiometry

d. Electrocardiogram

e. Comprehensive vision

f. Vital signs

2.5.7 MEDICAL EVALUATION PACKAGE REPORTING:

a) The Candidate/pre Hire Report: The Servicing Agency shall detail the Medical Examinations and Testing services provided to TSA TSS-EDCH, TSS-E, and criminal investigator applicants as follows:

Name of Candidate

Service Provided

Location

Date

Total Actual Cost

b) The Service Schedule of Appointments Report: For each candidate applicant referred, the Servicing Agency shall detail the schedule appointment date/time of Examinations and Testing services provided to TSA TSS-EDCH, TSS-E, and criminal investigator applicants as follows:

Date TSA referred applicant candidate to contractor

Name of Candidate

Date of Appointment

Rescheduled Appointment date (If applicable)

Date of Cancellation (if Applicable)

Date Medical Evaluation (Examination/Testing) completed

Total number of medical evaluations completed each month

Number of medical evaluations exceeding 10 business days each month

3.0 DELIVERABLES

All Deliverables shall be the property of the Government. Subsequent to their initial acceptance by the Government, any changes to the Deliverables shall require Government review and approval prior to their implementation. The Government reserves the right to require additional documents to meet specific task requirements. The Contractor shall adhere to deadlines and deliverables as assigned, unless specified otherwise under subject contract.

The contractor shall prepare all written reports and deliverables using Microsoft Office ® suite of software (i.e. MS Word, Excel, PowerPoint, or Visio) or as otherwise specified by TSA and submit all files electronically to the TSA Program Manager (PM) and COR.

# Potential

Deliverable (depending on service performed)

Due Date Deliverable Recipient (include contact information)

Contract Reference

1. TSO Medical Scheduling Capability

Upon completion of transition period; updates as requested by

TSA.

PM and COR

2.1.3

2. TSO Candidate Medical Tracking Capability

Upon completion of transition period; updates as requested by

TSA.

PM and COR

2.1.5

3. Mobile Medical and Drug Testing Evaluation Units

Within (3) weeks or less upon receiving

TSA OHC

approval.

PM and COR

2.1.6

4. TSO Quarterly Medical/Drug Testing Site

Quality Assurance

Reviews and Reports

Quarterly starting 3 months after contract award.

PM and COR

2.1.11

5. TSO

Medical/Drug

Incident Reports

As requested by

TSA.

PM and COR 2.1.12

6. EEO Cases and Litigation

Documentation

As requested by

TSA.

PM and COR 2.2.6

7. TSO Candidate Medical Records

Inventory

As requested by

TSA.

PM and COR 2.2.7

8 Medical Evaluation

Package (Examination and/or Testing)

Within (2) business days of Medical Evaluation

PM and COR

2.5.7

9 Per Candidate/ Pre Hire Report

Monthly PM and COR 2.5.7a

10 Service Schedule of Appointments

Report Monthly

PM and COR 2.5.7b

4.0 Transition-In Support

In support of Transition-In, the Contractor shall:

At contract end/closing, or at any time during the contract period of performance at the request of the Contracting Officer and at no additional cost to the Government, the Contractor shall be responsible for all activities and early and continuous coordination with transition-out Contractor to ensure seamless and timely transition. These activities include but are not limited to the development and seamless coordinated execution of a detailed transition-in Integrated Master Schedule.

a. In developing the Transition-In Plan, the Contractor shall consider all known timelines and schedules for other HC transition activities.

The Transition-In Plan shall include, at a minimum, the following:

a. A communication plan that addresses coordination with the Incumbent Contractor and the Government representatives, method of communicating knowledge, status, progress, and other transition-related information to stakeholders.

b. The management structure needed for the transition.

c. Identify the point(s) of contact for all services, along with the roles and responsibilities and time commitment required for each of the transition team members.

d. The Staffing Approach for the project, to include Contractor Full Time Equivalents

(FTEs) to support the transition.

e. The anticipated impact the transition strategy/approach will have on existing operations and services provided to TSA, and recommendations for minimizing those impacts.

f. Work Breakdown Structure (WBS) and schedule of transition work activities required to accomplish the transition. This includes All Work-In-Progress (WIP) and the corresponding schedule for completion. Dependencies among the transition activities and critical path activities shall be identified. Due to the lag times inherent to end-to-end processing of personnel transactions, the Transition-In Plan shall specifically address WIP personnel transactions received but not finalized prior to transition cut-over.

g. The known transition risks, mitigation and management strategies; additionally, the strategy to identify, mitigate, manage and communicate emerging risks.

h. The Contractor shall support the following transition-in activities:

i. Host/participate in contract start ingress knowledge transfer sessions as required by TSA.

j. Perform contract start ingress migration of active candidate and historic candidate data.

5.0 Transition-Out Support and Closeout Performance

In support of Transition-Out, the Contractor shall:

The Contractor shall develop, provide, and execute a Transition-Out Plan to transfer all knowledge and records, and provide system access, while minimizing service disruption and degradation to vital Government business before and during transition.

At contract end/closing, or at any time during the contract period of performance at the request of the Contracting Officer and at no additional cost to the Government, the Contractor shall be responsible for all activities and early and continuous coordination with transition-in Contractor to ensure seamless and timely transition. These activities include but are not limited to the development and seamless coordinated execution of a detailed transition-in Integrated Master Schedule. This also includes the return of any and all requested data and electronic information, and provide related reporting as requested.

This also includes any system configurations documentation provided in a generic usable file format based on underlying open standards and with no proprietary extensions or markings. All data and information developed by, entered into and processed through any systems used during this contract shall be the sole property of the Government. The Contractor shall provide the meaning of any data, all distinctions between decision support data and operational data, the interface mapping between the source systems and the data, mappings between output systems and data, and any current dependencies on the existing system and other systems. Transfer methods shall follow DHS and TSA IT Security Protocols.

a. In developing the Transition-Out Plan, the Contractor shall consider all known timelines and schedules for other HC transition activities.

The Contractor shall continue to fulfill current contractual requirements until the transition-in Contractor assumes full operational responsibility while providing transition support. This includes any workarounds required to ensure essential operations can be continued if normal processing or systems are interrupted.

The Contractor shall support the following transition out activities:

a. Document the Contract Processes.

The Contractor shall document the current (as-is) process flows, to include the necessary system interfaces, and service provider roles, responsibilities, and hand-offs.

The Contractor shall submit the draft transition-out plan as directed by the Contracting Officer. The final transition-out plan shall be due within five days after receipt of the Government’s comments.

b. Support Knowledge Transfer.

The Contractor shall provide hands-on training and knowledge transfer to the incoming vendor as part of the transition.

The knowledge and skill areas about the TSA operational environment and services necessary to successfully assume responsibility for providing the services.

c. Maintain Current Services.

The Contractor shall ensure continuity of all services currently within the scope of the contract until the end of the transition period.

The Contractor shall identify any breaks in current operational processes, and recommend corrective courses of action.

d. Support Project Status Reviews.

The Contractor shall attend, either in person or by teleconference, weekly project status reviews at the request of the Contracting Officer.

In support of Contract Closeout Performance, the Contractor shall:

e. 180 business days before the end of the contract period of performance, or at any date at the request of the Contracting Officer and at no additional cost to the Government, the Contractor shall provide TSA with a detailed Transition/Closeout Plan that describes all of the tasks, activities, and schedules associated with contract egress and closeout.

f. Upon termination of the contract, the Contractor shall provide all data produced under this contract to TSA and all copies destroyed in accordance with TSA data security protocols. The data shall be provided to TSA in a format approved by TSA, and all Contractor systems shall be sanitized at the end of the contract.

g. At contract end/closing, or at the request of the Contracting Officer and at no additional cost to the Government, the Contractor shall ship and/or deliver all GFE, property, supplies, data etc. to locations as directed by TSA Contracting Officer.

5.0 Travel Requirements

Travel is reimbursable based upon the current per diem as set forth in the Federal Travel Regulations. The contractor shall follow allowable cost rules for contractor’s travel and transportation allowances which are usually IAW Part 31 of the Federal Acquisition Regulation (FAR) (which relies in large part on each contractor’s own travel rules). As required to support on site delivery of services at any TSA location. All Federal Travel Regulations apply and contractors must submit appropriate receipts with request for reimbursement of travel. Also see Section IV paragraph 4.10 H.5200.231.001 TRAVEL AND PER DIEM (JUL 2015).

6.0 Period of Performance

The contract period of performance for this effort is a 6-month base period with four 1-year option periods and one 6-month option period to be exercised at the discretion of the government, if determined to be in the best interest of the government. The period of performance for this effort will begin 60 days after contract award and shall be for one (1) base period (See Section 3, paragraph 3.26, H.5201.242.001 - Period of Performance for Contracts Requiring Employee Background Checks), plus five (5) option periods.

The Base Period will begin at a date TBD once all Primary contractor personnel have been adjudicated and receive a favorable Suitability Determination. The Period of Performance Dates will be incorporated Via modification once all Primary contractor personnel have been properly vetted in accordance with Special Requirement Clause, Section III, H.5201.209.001

SUITABILITY DETERMINATION FOR CONTRACTOR EMPLOYEES.

7.0 Place of Performance

The Contractor shall perform services at TSA HQ and TSA Field Office (CONUS and US territories) locations. A Nationwide Network of Medical Services (NNMS) affiliates within twenty-five (25) miles of each airport and Federal Air Marshall Service (FAMS) Field Office, for TSA candidates and employees.

END OF SECTION II

DHS and TSA Enterprise Architecture Compliance (FEB 2022)

a) The Contractor shall ensure that all architectural artifacts including but not limited to solutions, business, Data, IT elements for legacy Transportation Security Equipment (TSE), Information Systems Security Agreements (ISSAs), System Design documents (SDDs), deliverables, and services are aligned and compliant with the current DHS and TSA Enterprise Architecture, and the (The Common Approach to Federal Enterprise Architecture), the Technology Business Management (TBM) Taxonomy, and Federal Information Technology Acquisition Reform Act (FITARA).

i. All solutions and services shall meet DHS and TSA Enterprise Architecture policies, standards, and procedures. Specifically:

a. DHS and TSA Enterprise Architecture policies, standards, and procedures.

b. Homeland Security Enterprise Architecture (HLS EA) and TSA EA requirements.

c. TSA and DHS IT Security, Cloud, Infrastructure (including Network), Application/Systems, Information/Data, Performance, and Business

Architecture policies, directives, guidelines, standards, segment architectures and reference architectures.

d. TSA functional capabilities

e. TSA operational capabilities

f. TSA lines of business

g. TSA business processes

h. TSA funding sources

i. TBM Taxonomy for IT cost transparency

ii. This includes new Transportation Security Equipment (TSE) and Legacy TSE that utilizes IT software, services, or equipment including embedded IT elements such as network switches, routers, In printers, etc.

iii. All solutions shall implement and leverage TSA information and data standards as defined and approved per TSA policy.

iv. All solution architectures and services (e.g., Application, System, Network, Security, Information/Data, Cloud) shall be reviewed and approved by TSA EA as part of the TSA SELC (System Engineering Life Cycle) review process and in accordance with TSA IT Governance Management Directive 1400.20 with applicable DHS and TSA IT governance policies, directives, and processes. This includes the Solution Engineering Review (SER), Preliminary Design Review (PDR) and Critical Design Review (CDR) stage gates. The required design artifacts include solution approach document, the PDR document, and the System Design Document (SDDs) as directed by EAD. Successful completion of the PDR/CDR stages results in an approved architecture which is required before proceeding to development. An approved architecture is also a necessary critical step in receiving an Authority to Operate (ATO). All implementations shall follow the approved solution architecture/design without deviation. Any changes, to either the prior approved solution and/or prior approved design that are identified during subsequent SELC phases, including testing, implementation and deployment, shall undergo additional EA review prior to proceeding.

v. TSA Offices acquiring Enterprise architecture type services at segment or solution levels shall engage and collaborate with the TSA Enterprise Architecture Division (EAD) to ensure strategic alignment of people, process, information, and technology and comply with enterprise level architecture governance, artifacts and standards.

a. The Contractor shall engage domain architect(s) in EAD before SELC Obtain Phase, i.e. during SELC Need or “Analyze and Select” Phase.

b. The Contractors shall collaborate with the EA domain architect(s) to deliver the required design artifacts and desired outcome under the guidance.

c. The Contractor shall provide architecture and system/application data and models in prescribed formats to be stored in TSA’s Enterprise Architecture Repository.

b) In accordance with the TSA Cloud Strategy 2.0, April 2019, TSA’s approach to cloud computing and governance of migration to the cloud, the contractor shall ensure that the cloud solutions utilize the SaaS (Software as a Service) model as its primary approach to cloud implementation, and also, when necessary will use Platform as a Service (PaaS) or Infrastructure as a Service (IaaS). The contractor shall adhere to the principles of cloud strategy to systematically retire or replace legacy applications by use of an integrated approach to cloud planning, architecture, hybrid deployment, and operation.

c) Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-21-07, November 2020) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant as defined in the U.S. Government Version 6 (USGv6) Profile (National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

Information and Data Governance and Management

d) The Contractor shall develop, use, and dispose of TSA information and data assets following the TSA governance processes established by the Enterprise Information/Data Governance Board (EIDGB), in compliance with the DHS Enterprise Data Governance and Management MD (Management Directive) 103-01.

i. TSA information and data assets include but are not limited to the TSA Data Catalog, TSA information and data standards, TSA Data Management Plan, TSA data sets (including open data sets for public consumption), TSA information and data stored in TSA repositories, TSA information and data in systems and applications (internal and external), and TSA information exchanges.

ii. All TSA information and data, and all solutions that capture, store, use and provide TSA information and data shall comply with the Geospatial Data Act (GDA) of 2018 (P.L. 115-254) that requires agencies to foster efficient management of geospatial data/information, technologies, and infrastructure through enhanced coordination among Federal, state, local, and tribal governments, along with private sector and academia.

iii. Description information for all data assets shall be submitted to the TSA Enterprise Architecture Team, who will be responsible for coordination with

DHS, and for review, approval and insertion into the TSA Data Reference Model and Enterprise Architecture Repository.

iv. In addition to the Federal Acquisitions Regulations (FAR) Subpart 27.4 – ‘Rights in Data and Copyrights’ and Section 35.011 detailing technical data delivery, the contractor shall provide all TSA-specific data in a format maintaining pre-existing referential integrity and data constraints, as well as data structures in a format understandable to TSA. Examples of data structures can be defined as, but not limited to:

a. Data models containing entities and attributes, identifying authoritative and trusted data sources, and depicting relationship mapping and, or linkages

b. Metadata information to define data definitions

c. Detailed data formats, type, and size

d. Delineations of the referential integrity (e.g., primary key/foreign key) of data schemas, structures, and or taxonomies

e. Information exchange specifications

v. All TSA-specific data shall be delivered in a secure and timely manner to TSA.

Data security is defined within the ‘Requirements for Handling Sensitive, Classified, and/or Proprietary Information’, section of this SOW (Statement of Work), SOO (Statement of Objectives) and PWS (Performance Work Statement).

This definition complies with not only the delivery of data, but also maintaining TSA-specific data within a non-TSA or DHS proprietary system.

vi. All metadata shall be pre-defined upon delivery to TSA. Metadata shall be delivered in a format that is readily interpretable by TSA (e.g., metadata shall be extracted from any metadata repository that is not utilized by TSA and delivered in a TSA approved manner). Metadata shall also provide an indication of historical version, the most current data to be used, as well as frequency of data refreshes.

vii. The contractor shall provide a Data Asset Repository Profile (DAR) and Data Management Plan (DMP) to EA using EA provided template before the preliminary/critical design review. The DAR and DMP include conceptual and logical data models, data dictionaries, data asset profile, and other artifacts pertinent to the project’s data.

viii. TSA adheres to the DHS NIEM (National Information Exchange Model) First policy and standards outlined in the DHS Memorandum, “Adoption of the National Information Exchange Model within the Department of Homeland Security,” dated May 3, 2019. All TSA information and data exchanges shall be

NIEM compliant. All TSA solutions that leverage TSA information and data exchanges shall be NIEM compliant.

Cybersecurity Policy for TSA Government Acquisitions (OCT 2021)

A. General Security Requirements:

A.1. All authorized, cleared and vetted personnel (i.e., federal employees; and primary, subcontractor, and/or 3rd party vendors or contractors supporting or doing business per agreement with TSA (either directly or indirectly) shall comply with applicable cybersecurity or information assurance (IA) policies as stated in the DHS 4300A Sensitive Systems Policy Directive, DHS 4300B National Security Systems (NSS) PD for classified systems, TSA MD

1400.3 Information Technology Security (ITS), TSA Information Assurance (IA) Handbook & supplemental Technical Standards (TSs) and Standard Operating Procedures (SOPs).

A.2. The Contractor shall comply with Federal, Department of Homeland Security (DHS) and Transportation Security Administration (TSA) security, sensitive information handling, and privacy guidelines in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

A.3. The Contractor shall perform periodic reviews to ensure compliance with cybersecurity, information security and privacy requirements.

A.4. The Contractor shall comply with proper DHS and TSA security controls to ensure that the Government's security requirements are met. These controls are described in DHS PD 4300A, TSA MD 1400.3 ITS and the TSA Information Assurance (IA) Handbook security policy documents and are based on the current National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 standards.

A.5. The Contractor shall include this guidance in all subcontracts at any tier where the subcontractor is performing the work defined in the Statement of Work (SOW), Performance Work Statement (PWS), Statement of Objective (SOO).

A.6. The Contractor shall ensure all of its staff members have the required level of approved security clearance commensurate with the sensitivity of the information being accessed, stored, processed, transmitted or otherwise handled by the system or required to perform the work stipulated by the contract. At a minimum, all Contractor staff shall be subjected to a Public Trust background check and be granted a Public Trust clearance before access to any system or other TSA resources as granted.

A.7. The Contractor shall sign a DHS Form 11000-6 Non-Disclosure Agreement (NDA) within thirty (30) calendar days of the contract start date.

A.8. The Contractor shall not release, publish, or disclose agency information to unauthorized personnel, and shall protect such information in accordance with the provisions of pertinent laws, regulations, and policies governing the confidentiality of sensitive information.

A.9. The Contractor shall ensure its staff follow all policies and procedures governing cybersecurity, physical, environmental, and information security described in the various TSA regulations pertaining thereto, and the specifications, directives, and manuals for conducting work to generate the products as required by the contract. Personnel shall be responsible for the physical security of their work area and government furnished equipment (GFE) issued to the contractor under the terms of the contract.

A.10. The Contractor shall make all system information and documentation produced (in support of the contract) available to TSA upon request.

B. Training Requirements:

B.1. All newly-arrived Contractor employees requiring system access shall receive initial “Organizational Security Fundamentals (OSF)” training within 60 days of assignment to the contract via the Online Learning Center (OLC). The COR shall initiate and facilitate this access.

Refresher training shall be completed annually thereafter. Another required OLC cybersecurity training course is the “Cybersecurity for TSA System Users (TSA-CYBRSCRTY-SYSTM-USRS)” training and would be the official TSA-wide course developed in accordance with mandated policy to safeguard TSA’s mission and assets. It is the annual course that all users shall take and the one leveraged against FISMA requirements. (Note: This course replaced the older animated “IT Security Awareness” training of the past).

B.2. The Contractor shall complete any TSA-related Privacy training on an annual basis.

B.3. Role-Based training is required for contract employees with Significant Security Responsibility (SSR), whose job proficiency is required for overall network security within TSA, and shall be in accordance with DHS and TSA policy. The contractor will be notified if they have a position with Significant Security Responsibilities.

B.4. Individuals with SSR shall have a documented individual training and education plan, which shall ensure currency with position skill requirements, with the first course to be accomplished within 90 days of employment or change of position. The individual training plan shall be refreshed annually or immediately after a change in the individual’s position description requirements.

B.5. Cybersecurity and privacy training supplied by the Contractor shall meet standards established by NIST and set forth in DHS and TSA security policy.

B.6. The Contractor shall maintain an accurate and up-to-date list of all vetted contractor employees who have completed training and shall submit this list to the Contracting Officer Representative (COR) upon request, or during DHS/TSA onsite validation visits performed on a periodic basis.

B.7. The contractor shall ensure its employees review, understand, and sign the TSA Form 1403 Computer and Wireless Mobile Device Access Agreement (CAA) prior to accessing any IT systems.

C. Configuration Management (hardware/software/applications):

C.1. Hardware or software configuration changes shall be in accordance with the current DHS Information Security Performance Plan, the DHS Continuous Diagnostics and Mitigation (CDM) Program to include dashboard reporting requirements and TSA’s Configuration Management policy. The TSA Chief Information Security Officer (CISO)/Executive Director for Information Assurance and Cybersecurity Division (IAD) shall be informed of and aware of all configuration changes to the TSA IT environment including, but not limited to: systems, hardware, software, applications, infrastructure architecture, infrastructure assets, and end user assets. The TSA IAD POC shall approve any Request for Change (RFC) prior to any development activity occurring for that change and shall define the security requirements for the requested change. The COR will provide access to the DHS Information Security Performance Plan.

C.2. The Contractor shall ensure all application, software…